claudish 14.18.0 → 14.18.2

package/dist/index.js

@@ -5494,7 +5494,7 @@ var init_onepassword_config = __esm(() => {
 });
 
 // src/version.ts
-var VERSION = "14.18.0";
+var VERSION = "14.18.2";
 
 // src/redact.ts
 function isPlaceholder(value) {
@@ -5584,6 +5584,19 @@ function redactExactValues(text, values) {
   }
   return out;
 }
+function containsExactValue(text, values) {
+  if (!text)
+    return false;
+  for (const value of values) {
+    if (typeof value !== "string" || value.length < SIGNING_VALUE_MIN_LENGTH)
+      continue;
+    for (const form of signingValueForms(value)) {
+      if (text.includes(form))
+        return true;
+    }
+  }
+  return false;
+}
 function redactForClient(text) {
   return redactSigningValues(text);
 }
@@ -26388,6 +26401,7 @@ var version2 = null, readForToken = null;
 
 // src/auth/antigravity-token.ts
 import { execFileSync } from "child_process";
+import { createHash as createHash3 } from "crypto";
 import { existsSync as existsSync11 } from "fs";
 import { homedir as homedir12 } from "os";
 import { join as join12 } from "path";
@@ -26395,6 +26409,8 @@ function invalidateReadStoreMemo() {
   cachedRawStore = null;
 }
 function defaultReadStore() {
+  if (process.env.CLAUDISH_DISABLE_KEYCHAIN === "1")
+    return null;
   if (process.platform !== "darwin") {
     logStderr("[Antigravity] Shared token store is macOS-only for now (other keyring backends are a follow-up).");
     return null;
@@ -26536,7 +26552,7 @@ function encodeRecord(rec) {
   return PREFIX + Buffer.from(JSON.stringify(rec), "utf8").toString("base64");
 }
 function readSharedAntigravityToken(deps = defaultDeps3) {
-  const rec = parseRecord2(deps.readStore());
+  const rec = readObservedRecord(deps);
   return rec ? rec.token : null;
 }
 function hasSharedAntigravityToken(deps = defaultDeps3) {
@@ -26583,11 +26599,44 @@ function captureAgyClientVersion(accessToken, deps) {
     log("[Antigravity] Could not read the agy version" + (kept ? `; keeping ${kept}.` : "; using the fallback version."));
   }
 }
+function antigravityTokenLineageMaterial(token) {
+  if (token.refresh_token)
+    return `refresh:${token.refresh_token}`;
+  if (token.access_token)
+    return `access:${token.access_token}`;
+  return;
+}
+function sha256(value) {
+  return createHash3("sha256").update(value).digest("hex");
+}
+function observeLineage(token) {
+  const material = token ? antigravityTokenLineageMaterial(token) : undefined;
+  observedLineage = material ? sha256(material) : null;
+  if (!observedLineage || !token?.access_token)
+    return;
+  const key = sha256(token.access_token);
+  lineageByAccessToken.delete(key);
+  lineageByAccessToken.set(key, observedLineage);
+  if (lineageByAccessToken.size > MAX_TRACKED_ACCESS_TOKENS) {
+    lineageByAccessToken.delete(lineageByAccessToken.keys().next().value);
+  }
+}
+function readObservedRecord(deps) {
+  const rec = parseRecord2(deps.readStore());
+  observeLineage(rec ? rec.token : null);
+  return rec;
+}
+function currentAntigravityTokenLineage() {
+  return observedLineage;
+}
+function lineageForAntigravityAccessToken(accessToken) {
+  return lineageByAccessToken.get(sha256(accessToken)) ?? null;
+}
 async function resolveValidToken(deps) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
-  const rec = parseRecord2(deps.readStore());
+  const rec = readObservedRecord(deps);
   if (!rec) {
     throw terminalCredentialError("[Antigravity] No Antigravity session found. Sign in with `claudish login antigravity`, " + "or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
@@ -26597,7 +26646,7 @@ async function resolveValidToken(deps) {
   }
   log("[Antigravity] Access token expired/near-expiry \u2014 asking the Antigravity CLI to refresh.");
   const outcome = deps.runAgyRefresh();
-  const refreshedRec = parseRecord2(deps.readStore());
+  const refreshedRec = readObservedRecord(deps);
   if (refreshedRec && !needsRefresh(refreshedRec.token, deps.now())) {
     log("[Antigravity] Shared token refreshed by the Antigravity CLI.");
     captureAgyClientVersion(refreshedRec.token.access_token, deps);
@@ -26634,8 +26683,8 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   if (process.platform !== "darwin") {
     throw terminalCredentialError("[Antigravity] The shared Antigravity token store is macOS-only for now. " + "Use g@<model> with GEMINI_API_KEY on this platform.");
   }
-  _resetAntigravityTokenState();
-  const rec = parseRecord2(deps.readStore());
+  resetObservedTokenState();
+  const rec = readObservedRecord(deps);
   if (!rec) {
     throw terminalCredentialError("[Antigravity] No Antigravity session found. Sign in with `claudish login antigravity`, " + "or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
@@ -26643,7 +26692,7 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   log("[Antigravity] Upstream rejected the current token \u2014 asking the Antigravity CLI to re-mint.");
   writeSharedAntigravityToken({ ...original, expiry: new Date(deps.now() - 1000).toISOString() }, deps);
   const outcome = deps.runAgyRefresh();
-  const refreshed = parseRecord2(deps.readStore());
+  const refreshed = readObservedRecord(deps);
   const token = refreshed?.token;
   if (token && token.access_token !== original.access_token && !needsRefresh(token, deps.now())) {
     log("[Antigravity] Shared token re-minted by the Antigravity CLI.");
@@ -26653,7 +26702,7 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   if (!refreshed || refreshed.token.access_token === original.access_token) {
     writeSharedAntigravityToken(original, deps);
   }
-  _resetAntigravityTokenState();
+  resetObservedTokenState();
   if (outcome.kind === "timeout" || outcome.kind === "failed") {
     const message = `[Antigravity] ${describeRefreshFailure(outcome)}`;
     if (outcome.kind === "timeout") {
@@ -26667,11 +26716,16 @@ async function forceRefreshAntigravityToken(deps = defaultDeps3) {
   throw terminalCredentialError("[Antigravity] The Antigravity session was rejected upstream and could not be re-minted. " + "Run `claudish login antigravity` to sign in again.");
 }
 function _resetAntigravityTokenState() {
+  resetObservedTokenState();
+  lineageByAccessToken.clear();
+}
+function resetObservedTokenState() {
   inFlight = null;
   cachedHasToken = null;
+  observedLineage = null;
   invalidateReadStoreMemo();
 }
-var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps3, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null;
+var KC_SERVICE = "gemini", KC_ACCOUNT = "antigravity", PREFIX = "go-keyring-base64:", EXPIRY_SKEW_MS = 120000, AGY_REFRESH_TIMEOUT_MS = 12000, AGY_VERSION_TIMEOUT_MS = 5000, READ_STORE_TTL_MS = 3000, cachedRawStore = null, defaultDeps3, KEYCHAIN_LOCKED_EXIT_CODES, cachedHasToken = null, HAS_TOKEN_TTL_MS = 5000, inFlight = null, observedLineage = null, MAX_TRACKED_ACCESS_TOKENS = 8, lineageByAccessToken;
 var init_antigravity_token = __esm(() => {
   init_logger();
   init_keychain();
@@ -26684,6 +26738,7 @@ var init_antigravity_token = __esm(() => {
     now: () => Date.now()
   };
   KEYCHAIN_LOCKED_EXIT_CODES = new Set([36, 51, 128]);
+  lineageByAccessToken = new Map;
 });
 
 // src/auth/antigravity-user.ts
@@ -26736,6 +26791,26 @@ function resetAntigravityUserCache() {
   agServedCache = null;
   agServedCacheAt = 0;
   agServedCacheVersion = null;
+  cachedAgLineage = null;
+}
+function syncAccountCaches() {
+  const lineage = currentAntigravityTokenLineage();
+  if (lineage === cachedAgLineage)
+    return;
+  if (cachedAgProjectId || agServedCache) {
+    log("[Antigravity] Token lineage changed; dropping the cached project, tier and models.");
+  }
+  resetAntigravityUserCache();
+  cachedAgLineage = lineage;
+}
+function lineageOfToken(accessToken) {
+  return lineageForAntigravityAccessToken(accessToken) ?? currentAntigravityTokenLineage();
+}
+function mayPublishFor(lineage) {
+  if (currentAntigravityTokenLineage() !== lineage)
+    return false;
+  syncAccountCaches();
+  return true;
 }
 async function callLoadCodeAssistAntigravity(accessToken) {
   const res = await fetch(`${apiBase()}:loadCodeAssist`, {
@@ -26753,7 +26828,9 @@ async function callLoadCodeAssistAntigravity(accessToken) {
   return await res.json();
 }
 async function setupAntigravityUser(accessToken) {
-  if (cachedAgProjectId && cachedAgTierId) {
+  syncAccountCaches();
+  const lineage = lineageOfToken(accessToken);
+  if (lineage === cachedAgLineage && cachedAgProjectId && cachedAgTierId) {
     return { projectId: cachedAgProjectId, tierId: cachedAgTierId };
   }
   const loadRes = await callLoadCodeAssistAntigravity(accessToken);
@@ -26763,13 +26840,18 @@ async function setupAntigravityUser(accessToken) {
   if (!projectId) {
     throw makeTerminalSetupError("Antigravity did not return a project for this account. Sign in to Antigravity " + "(`claudish login antigravity`) and try again, or use g@<model> with GEMINI_API_KEY " + "(get one at https://aistudio.google.com/app/apikey).");
   }
-  cachedAgProjectId = projectId;
-  cachedAgTierId = resolvedTier;
-  cachedAgTierName = loadRes.paidTier?.name || null;
+  if (mayPublishFor(lineage)) {
+    cachedAgProjectId = projectId;
+    cachedAgTierId = resolvedTier;
+    cachedAgTierName = loadRes.paidTier?.name || null;
+  } else {
+    log("[Antigravity] Token lineage changed during setup; the result is not cached.");
+  }
   log(`[Antigravity] User set up, project: ${projectId}, tier: ${resolvedTier}`);
   return { projectId, tierId: resolvedTier };
 }
 function getAntigravityTierDisplayName() {
+  syncAccountCaches();
   if (!cachedAgTierName && !cachedAgTierId)
     return "Antigravity";
   const id = cachedAgTierId || "";
@@ -26859,6 +26941,9 @@ async function fetchAntigravityAvailableModelsRaw(accessToken, projectId, opts)
   }
 }
 async function getServedAntigravityModels(accessToken, projectId, opts) {
+  syncAccountCaches();
+  const lineage = lineageOfToken(accessToken);
+  const ownList = lineage === cachedAgLineage;
   const now = Date.now();
   const version = antigravityClientVersion();
   if (agServedCache && agServedCacheVersion !== version) {
@@ -26866,9 +26951,10 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
     agServedCache = null;
     agServedCacheAt = 0;
   }
-  if (!opts?.force && agServedCache && now - agServedCacheAt < SERVED_MODELS_TTL_MS) {
+  if (!opts?.force && ownList && agServedCache && now - agServedCacheAt < SERVED_MODELS_TTL_MS) {
     return agServedCache;
   }
+  const prior = ownList ? agServedCache : null;
   try {
     const raw = await fetchAntigravityAvailableModelsRaw(accessToken, projectId);
     if (raw.kind === "unreachable") {
@@ -26916,7 +27002,7 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
             deprecatedReplacements[oldId] = info.newModelId;
         }
         const agentModelIds = flattenAgentModelSorts(data.agentModelSorts);
-        agServedCache = {
+        const served = {
           servedIds,
           defaultId,
           meta,
@@ -26924,26 +27010,34 @@ async function getServedAntigravityModels(accessToken, projectId, opts) {
           deprecatedReplacements,
           ...agentModelIds ? { agentModelIds } : {}
         };
+        if (!mayPublishFor(lineage)) {
+          log("[Antigravity] Token lineage changed during discovery; the result is not cached.");
+          return served;
+        }
+        agServedCache = served;
         agServedCacheAt = now;
         agServedCacheVersion = raw.clientVersion;
-        return agServedCache;
+        return served;
       }
     }
   } catch (err) {
     log(`[Antigravity] fetchAvailableModels error: ${err}`);
   }
-  if (agServedCache)
-    return agServedCache;
+  if (prior)
+    return prior;
   return { servedIds: [], defaultId: null, meta: {} };
 }
 function peekServedAntigravityModels() {
   if (!agServedCache || agServedCacheVersion !== antigravityClientVersion())
     return null;
+  if (cachedAgLineage !== currentAntigravityTokenLineage())
+    return null;
   return agServedCache;
 }
-var ANTIGRAVITY_DEFAULT_HOST = "https://daily-cloudcode-pa.googleapis.com", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", AGY_FALLBACK_CLIENT_VERSION = "1.1.9", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, agServedCache = null, agServedCacheAt = 0, agServedCacheVersion = null;
+var ANTIGRAVITY_DEFAULT_HOST = "https://daily-cloudcode-pa.googleapis.com", SERVED_MODELS_TTL_MS, ANTIGRAVITY_IDE_TYPE = "ANTIGRAVITY", AGY_FALLBACK_CLIENT_VERSION = "1.1.9", cachedAgProjectId = null, cachedAgTierId = null, cachedAgTierName = null, cachedAgLineage = null, agServedCache = null, agServedCacheAt = 0, agServedCacheVersion = null;
 var init_antigravity_user = __esm(() => {
   init_logger();
+  init_antigravity_token();
   SERVED_MODELS_TTL_MS = 10 * 60 * 1000;
 });
 
@@ -27305,7 +27399,7 @@ var init_credential_file = __esm(() => {
 
 // src/auth/oauth-manager.ts
 import { exec as exec2 } from "child_process";
-import { createHash as createHash3, randomBytes as randomBytes5 } from "crypto";
+import { createHash as createHash4, randomBytes as randomBytes5 } from "crypto";
 import { existsSync as existsSync12, mkdirSync as mkdirSync10, unlinkSync as unlinkSync5 } from "fs";
 import { homedir as homedir13 } from "os";
 import { join as join13 } from "path";
@@ -27408,7 +27502,7 @@ class OAuthManager {
     return randomBytes5(64).toString("base64url");
   }
   generateCodeChallenge(verifier) {
-    return createHash3("sha256").update(verifier).digest("base64url");
+    return createHash4("sha256").update(verifier).digest("base64url");
   }
   async openBrowser(url, message) {
     try {
@@ -28774,9 +28868,9 @@ var init_registry2 = __esm(() => {
 });
 
 // src/code-mode/ids.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 function sha256Hex(input) {
-  return createHash4("sha256").update(input).digest("hex");
+  return createHash5("sha256").update(input).digest("hex");
 }
 function accountKeyFromBinding(binding) {
   const auth = binding?.auth;
@@ -28814,8 +28908,8 @@ function decodeNestedId(id) {
   return { execKey: match[1], seq: Number(match[2]) };
 }
 function uuidV5(namespace, name) {
-  const ns = createHash4("sha256").update(namespace).digest().subarray(0, 16);
-  const hash = createHash4("sha1").update(ns).update(name).digest();
+  const ns = createHash5("sha256").update(namespace).digest().subarray(0, 16);
+  const hash = createHash5("sha1").update(ns).update(name).digest();
   const bytes = Buffer.from(hash.subarray(0, 16));
   bytes[6] = bytes[6] & 15 | 80;
   bytes[8] = bytes[8] & 63 | 128;
@@ -29177,7 +29271,7 @@ var init_exec_tool = __esm(() => {
 });
 
 // src/code-mode/hashes.ts
-import { createHash as createHash5 } from "crypto";
+import { createHash as createHash6 } from "crypto";
 function withoutCacheMarkers(value) {
   if (Array.isArray(value))
     return value.map(withoutCacheMarkers);
@@ -29200,7 +29294,7 @@ function canonicalJson(value) {
   return `{${body}}`;
 }
 function inputHash(input) {
-  return createHash5("sha256").update(canonicalJson(input ?? {})).digest("hex");
+  return createHash6("sha256").update(canonicalJson(input ?? {})).digest("hex");
 }
 function compareIds(a, b) {
   const da = decodeNestedId(a);
@@ -29211,7 +29305,7 @@ function compareIds(a, b) {
 }
 function batchHash(entries) {
   const ordered = [...entries].sort((a, b) => compareIds(a.toolUseId, b.toolUseId));
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   for (const entry of ordered) {
     const canonical = entry.result ? canonicalJson([
       entry.toolUseId,
@@ -29225,7 +29319,7 @@ function batchHash(entries) {
   return hash.digest("hex");
 }
 function completionKey(batchHashes) {
-  const hash = createHash5("sha256");
+  const hash = createHash6("sha256");
   for (const h of batchHashes) {
     hash.update(h);
     hash.update(`
@@ -33358,9 +33452,9 @@ var init_prelude = __esm(() => {
 });
 
 // src/code-mode/sandbox/script-runtime.ts
-import { createHash as createHash6 } from "crypto";
+import { createHash as createHash7 } from "crypto";
 function seedNumber(seed) {
-  return createHash6("sha256").update(seed).digest().readUInt32BE(0);
+  return createHash7("sha256").update(seed).digest().readUInt32BE(0);
 }
 function utf8Bytes2(text) {
   return Buffer.byteLength(text, "utf8");
@@ -33906,9 +34000,9 @@ var init_script_runtime = __esm(() => {
 });
 
 // src/code-mode/turn-records.ts
-import { createHash as createHash7 } from "crypto";
+import { createHash as createHash8 } from "crypto";
 function sha256Hex2(text) {
-  return createHash7("sha256").update(text).digest("hex");
+  return createHash8("sha256").update(text).digest("hex");
 }
 function recordKey(sessionKey, anchor) {
   return `${sessionKey}\x00${anchor}`;
@@ -34251,6 +34345,236 @@ var init_harness = __esm(() => {
   SKILL_LINE = /^-\s+([a-z0-9][a-z0-9:_-]*):\s*(.+)$/i;
 });
 
+// src/handlers/shared/call-context.ts
+function createSigningSecrets() {
+  return { values: new Set, lease: acquireSigningLease() };
+}
+function signingSecretsOf(c) {
+  const installed = readCallVar(c, SIGNING_SECRETS_KEY);
+  if (installed)
+    return installed;
+  const lazy = createSigningSecrets();
+  writeCallVar(c, SIGNING_SECRETS_KEY, lazy);
+  return lazy;
+}
+function readCallVar(c, key) {
+  if (!c || typeof c !== "object")
+    return;
+  const store = c;
+  if (typeof store.get === "function")
+    return store.get(key);
+  return detachedCallVars.get(c)?.get(key);
+}
+function writeCallVar(c, key, value) {
+  if (!c || typeof c !== "object")
+    return;
+  const store = c;
+  if (typeof store.set === "function") {
+    store.set(key, value);
+    return;
+  }
+  let vars = detachedCallVars.get(c);
+  if (!vars) {
+    vars = new Map;
+    detachedCallVars.set(c, vars);
+  }
+  vars.set(key, value);
+}
+function addSigningSecrets(c, values) {
+  const secrets = signingSecretsOf(c);
+  const list = [...values].filter((v) => typeof v === "string" && v.length > 0);
+  for (const value of list)
+    secrets.values.add(value);
+  secrets.lease.add(list);
+}
+function isCredentialHeader(name) {
+  const lower = name.toLowerCase();
+  if (CREDENTIAL_HEADER_NAMES.has(lower))
+    return true;
+  return CREDENTIAL_HEADER_FRAGMENTS.some((fragment) => lower.includes(fragment));
+}
+function credentialPartsOf(name, value) {
+  const parts = [value];
+  const bare = value.replace(AUTH_SCHEME_PREFIX, "");
+  if (bare !== value)
+    parts.push(bare);
+  if (name.toLowerCase() === "cookie") {
+    for (const pair of value.split(";")) {
+      const eq = pair.indexOf("=");
+      if (eq > 0)
+        parts.push(pair.slice(eq + 1).trim());
+    }
+  }
+  return parts;
+}
+function credentialValuesFromRequest(headers, endpoint) {
+  const out = [];
+  for (const [name, value] of Object.entries(headers ?? {})) {
+    if (typeof value !== "string" || !value || !isCredentialHeader(name))
+      continue;
+    out.push(...credentialPartsOf(name, value));
+  }
+  if (endpoint) {
+    try {
+      for (const [name, value] of new URL(endpoint).searchParams) {
+        if (value && CREDENTIAL_QUERY_NAMES.has(name.toLowerCase()))
+          out.push(value);
+      }
+    } catch {}
+  }
+  return out;
+}
+function releaseWhenBodyEnds(response, release) {
+  const source = response.body;
+  if (!source) {
+    release();
+    return response;
+  }
+  const reader = source.getReader();
+  let cancelling = false;
+  const stream = new ReadableStream({
+    async pull(controller) {
+      let result;
+      try {
+        result = await reader.read();
+      } catch (err) {
+        if (cancelling)
+          return;
+        release();
+        controller.error(err);
+        return;
+      }
+      if (cancelling)
+        return;
+      if (result.done) {
+        release();
+        controller.close();
+        return;
+      }
+      controller.enqueue(result.value);
+    },
+    async cancel(reason) {
+      cancelling = true;
+      try {
+        await reader.cancel(reason);
+      } catch {} finally {
+        release();
+      }
+    }
+  }, { highWaterMark: 0 });
+  return new Response(stream, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers
+  });
+}
+function callAbortSignal(c) {
+  return readCallVar(c, CALL_ABORT_SIGNAL_KEY);
+}
+function callAborted(c) {
+  return callAbortSignal(c)?.aborted === true;
+}
+function callAbortError() {
+  return new DOMException("the call's deadline passed; claudish stopped its work", "AbortError");
+}
+function raceCallAbort(p, signal) {
+  if (!signal)
+    return p;
+  p.catch(() => {});
+  if (signal.aborted)
+    return Promise.reject(callAbortError());
+  return new Promise((resolve, reject) => {
+    const onAbort = () => reject(callAbortError());
+    signal.addEventListener("abort", onAbort, { once: true });
+    p.then((value) => {
+      signal.removeEventListener("abort", onAbort);
+      resolve(value);
+    }, (err) => {
+      signal.removeEventListener("abort", onAbort);
+      reject(err);
+    });
+  });
+}
+function sleepUnlessAborted(ms, signal) {
+  if (signal?.aborted)
+    return Promise.resolve(true);
+  return new Promise((resolve) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      resolve(true);
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve(false);
+    }, ms);
+    signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+function withCallSignal(sig, callSignal) {
+  if (!callSignal)
+    return sig;
+  if (!sig)
+    return callSignal;
+  return AbortSignal.any([sig, callSignal]);
+}
+function abortedResponse() {
+  return new Response(JSON.stringify({
+    type: "error",
+    error: {
+      type: "timeout_error",
+      message: "claudish stopped this call: its deadline passed"
+    }
+  }), {
+    status: 408,
+    headers: { "content-type": "application/json", [CALL_ABORTED_HEADER]: "1" }
+  });
+}
+function hopLogOf(c) {
+  return readCallVar(c, HOP_LOG_KEY);
+}
+function recordHopEntry(c, provider, wireModel) {
+  const hops = hopLogOf(c);
+  if (!hops)
+    return;
+  const plannedUid = readCallVar(c, PLANNED_HOP_KEY);
+  const entry = {
+    provider,
+    wireModel,
+    arm: null,
+    billing: null,
+    ...plannedUid ? { plannedUid } : {}
+  };
+  hops.push(entry);
+  return entry;
+}
+async function withPlannedHop(c, plannedUid, work) {
+  if (!hopLogOf(c))
+    return work();
+  const previous = readCallVar(c, PLANNED_HOP_KEY);
+  writeCallVar(c, PLANNED_HOP_KEY, plannedUid);
+  try {
+    return await work();
+  } finally {
+    writeCallVar(c, PLANNED_HOP_KEY, previous);
+  }
+}
+var SIGNING_SECRETS_KEY = "claudishSigningSecrets", detachedCallVars, CREDENTIAL_HEADER_NAMES, CREDENTIAL_HEADER_FRAGMENTS, CREDENTIAL_QUERY_NAMES, AUTH_SCHEME_PREFIX, CALL_ABORT_SIGNAL_KEY = "claudishCallAbortSignal", CALL_ABORTED_HEADER = "x-claudish-call-aborted", HOP_LOG_KEY = "claudishHopLog", PLANNED_HOP_KEY = "claudishPlannedHop";
+var init_call_context = __esm(() => {
+  init_redact();
+  detachedCallVars = new WeakMap;
+  CREDENTIAL_HEADER_NAMES = new Set([
+    "authorization",
+    "proxy-authorization",
+    "x-api-key",
+    "api-key",
+    "x-goog-api-key",
+    "cookie"
+  ]);
+  CREDENTIAL_HEADER_FRAGMENTS = ["token", "secret", "key"];
+  CREDENTIAL_QUERY_NAMES = new Set(["key", "api_key", "token", "access_token"]);
+  AUTH_SCHEME_PREFIX = /^(?:Bearer|Basic|Token)\s+/i;
+});
+
 // src/providers/codex-models-discovery.ts
 import { existsSync as existsSync14, readFileSync as readFileSync18 } from "fs";
 import { homedir as homedir16 } from "os";
@@ -34322,6 +34646,21 @@ function toModelTable(body) {
   }
   return table;
 }
+function dropCredentialTiers(table, credentialValues) {
+  let dropped = 0;
+  for (const info of table.values()) {
+    if (info.serviceTiers) {
+      const kept = info.serviceTiers.filter((tier) => !containsExactValue(tier.id, credentialValues) && !containsExactValue(tier.name, credentialValues));
+      dropped += info.serviceTiers.length - kept.length;
+      info.serviceTiers = kept;
+    }
+    if (info.defaultServiceTier !== undefined && containsExactValue(info.defaultServiceTier, credentialValues)) {
+      delete info.defaultServiceTier;
+      dropped++;
+    }
+  }
+  return dropped;
+}
 function discoveryHeaders(binding) {
   const headers = {};
   for (const [name, value] of Object.entries(binding.auth?.headers ?? {})) {
@@ -34355,6 +34694,10 @@ async function fetchModelTable(binding, opts) {
       log("[CodexDiscovery] GET /models body has no models array");
       return;
     }
+    const dropped = dropCredentialTiers(table, credentialValuesFromRequest(binding.auth?.headers, binding.auth?.endpoint));
+    if (dropped > 0) {
+      log(`[CodexDiscovery] dropped ${dropped} service tier(s) that contain a credential value`);
+    }
     log(`[CodexDiscovery] GET /models: ${table.size} model(s)`);
     return table;
   } catch (err) {
@@ -34437,7 +34780,9 @@ async function getCodexModelInfo(slug, binding, accountKey, opts = {}) {
 }
 var CODEX_DISCOVERY_CLIENT_VERSION = "0.161.0", CODEX_DISCOVERY_TTL_MS, CODEX_DISCOVERY_FETCH_TIMEOUT_MS = 1e4, CODEX_DISCOVERY_DEFAULT_WAIT_MS = 2000, FAILURE_RETRY_AFTER_MS, memo;
 var init_codex_models_discovery = __esm(() => {
+  init_call_context();
   init_logger();
+  init_redact();
   CODEX_DISCOVERY_TTL_MS = 60 * 60 * 1000;
   FAILURE_RETRY_AFTER_MS = 60 * 1000;
   memo = new Map;
@@ -34494,9 +34839,9 @@ var init_tool_results = __esm(() => {
 });
 
 // src/code-mode/transliterate.ts
-import { createHash as createHash8 } from "crypto";
+import { createHash as createHash9 } from "crypto";
 function transliteratedCallId(firstToolUseId) {
-  return `call_${createHash8("sha256").update(firstToolUseId).digest("hex").slice(0, 32)}`;
+  return `call_${createHash9("sha256").update(firstToolUseId).digest("hex").slice(0, 32)}`;
 }
 function callExpression(use, names) {
   const name = typeof use.name === "string" ? use.name : "";
@@ -34570,12 +34915,12 @@ function relayNestedInput(block, repair) {
 }
 
 // src/code-mode/input-builder.ts
-import { createHash as createHash9 } from "crypto";
+import { createHash as createHash10 } from "crypto";
 function blocksOf2(message) {
   return message && Array.isArray(message.content) ? message.content : [];
 }
 function sha256Hex3(text) {
-  return createHash9("sha256").update(text).digest("hex");
+  return createHash10("sha256").update(text).digest("hex");
 }
 function reasoningKey(item) {
   if (typeof item.id === "string" && item.id)
@@ -35326,7 +35671,7 @@ var init_stores = __esm(() => {
 });
 
 // src/code-mode/request.ts
-import { createHash as createHash10 } from "crypto";
+import { createHash as createHash11 } from "crypto";
 function isLiteFallbackActive(model, now = Date.now()) {
   const until = liteFallbackUntil.get(model.toLowerCase());
   if (until === undefined)
@@ -35369,7 +35714,7 @@ function applyCodeModeToPayload(payload, ctx) {
   if (shape === "lite") {
     const reasoning = liteReasoning(payload, ctx.modelInfo);
     if (reasoning) {
-      const toolsHash = createHash10("sha256").update(JSON.stringify(ctx.execTool)).digest("hex");
+      const toolsHash = createHash11("sha256").update(JSON.stringify(ctx.execTool)).digest("hex");
       payload.reasoning = reasoning;
       delete payload.tools;
       delete payload.instructions;
@@ -37647,7 +37992,7 @@ var init_output_capture = __esm(() => {
 });
 
 // src/hooks/telemetry/aggregate.ts
-import { createHash as createHash11, randomBytes as randomBytes6 } from "crypto";
+import { createHash as createHash12, randomBytes as randomBytes6 } from "crypto";
 import { appendFileSync as appendFileSync2, mkdirSync as mkdirSync11 } from "fs";
 import { homedir as homedir19 } from "os";
 import { dirname as dirname11, join as join19 } from "path";
@@ -37671,7 +38016,7 @@ function contextFillPct(peakTokens, window2 = enforcedContextWindow) {
   return Math.min(100, Math.max(0, Math.round(peakTokens / window2 * 100)));
 }
 function hashSessionId(rawSessionId, model) {
-  return createHash11("sha256").update(`${SESSION_SALT}:${rawSessionId}:${model}`).digest("hex");
+  return createHash12("sha256").update(`${SESSION_SALT}:${rawSessionId}:${model}`).digest("hex");
 }
 function setTelemetryConsent(value) {
   consent = value;
@@ -41218,236 +41563,6 @@ function decideCodexSpeed(speed, modelInfo) {
 }
 var CODEX_SERVICE_TIER_POINTER = "/service_tier";
 
-// src/handlers/shared/call-context.ts
-function createSigningSecrets() {
-  return { values: new Set, lease: acquireSigningLease() };
-}
-function signingSecretsOf(c) {
-  const installed = readCallVar(c, SIGNING_SECRETS_KEY);
-  if (installed)
-    return installed;
-  const lazy = createSigningSecrets();
-  writeCallVar(c, SIGNING_SECRETS_KEY, lazy);
-  return lazy;
-}
-function readCallVar(c, key) {
-  if (!c || typeof c !== "object")
-    return;
-  const store = c;
-  if (typeof store.get === "function")
-    return store.get(key);
-  return detachedCallVars.get(c)?.get(key);
-}
-function writeCallVar(c, key, value) {
-  if (!c || typeof c !== "object")
-    return;
-  const store = c;
-  if (typeof store.set === "function") {
-    store.set(key, value);
-    return;
-  }
-  let vars = detachedCallVars.get(c);
-  if (!vars) {
-    vars = new Map;
-    detachedCallVars.set(c, vars);
-  }
-  vars.set(key, value);
-}
-function addSigningSecrets(c, values) {
-  const secrets = signingSecretsOf(c);
-  const list = [...values].filter((v) => typeof v === "string" && v.length > 0);
-  for (const value of list)
-    secrets.values.add(value);
-  secrets.lease.add(list);
-}
-function isCredentialHeader(name) {
-  const lower = name.toLowerCase();
-  if (CREDENTIAL_HEADER_NAMES.has(lower))
-    return true;
-  return CREDENTIAL_HEADER_FRAGMENTS.some((fragment) => lower.includes(fragment));
-}
-function credentialPartsOf(name, value) {
-  const parts = [value];
-  const bare = value.replace(AUTH_SCHEME_PREFIX, "");
-  if (bare !== value)
-    parts.push(bare);
-  if (name.toLowerCase() === "cookie") {
-    for (const pair of value.split(";")) {
-      const eq = pair.indexOf("=");
-      if (eq > 0)
-        parts.push(pair.slice(eq + 1).trim());
-    }
-  }
-  return parts;
-}
-function credentialValuesFromRequest(headers, endpoint) {
-  const out = [];
-  for (const [name, value] of Object.entries(headers ?? {})) {
-    if (typeof value !== "string" || !value || !isCredentialHeader(name))
-      continue;
-    out.push(...credentialPartsOf(name, value));
-  }
-  if (endpoint) {
-    try {
-      for (const [name, value] of new URL(endpoint).searchParams) {
-        if (value && CREDENTIAL_QUERY_NAMES.has(name.toLowerCase()))
-          out.push(value);
-      }
-    } catch {}
-  }
-  return out;
-}
-function releaseWhenBodyEnds(response, release) {
-  const source = response.body;
-  if (!source) {
-    release();
-    return response;
-  }
-  const reader = source.getReader();
-  let cancelling = false;
-  const stream = new ReadableStream({
-    async pull(controller) {
-      let result;
-      try {
-        result = await reader.read();
-      } catch (err) {
-        if (cancelling)
-          return;
-        release();
-        controller.error(err);
-        return;
-      }
-      if (cancelling)
-        return;
-      if (result.done) {
-        release();
-        controller.close();
-        return;
-      }
-      controller.enqueue(result.value);
-    },
-    async cancel(reason) {
-      cancelling = true;
-      try {
-        await reader.cancel(reason);
-      } catch {} finally {
-        release();
-      }
-    }
-  }, { highWaterMark: 0 });
-  return new Response(stream, {
-    status: response.status,
-    statusText: response.statusText,
-    headers: response.headers
-  });
-}
-function callAbortSignal(c) {
-  return readCallVar(c, CALL_ABORT_SIGNAL_KEY);
-}
-function callAborted(c) {
-  return callAbortSignal(c)?.aborted === true;
-}
-function callAbortError() {
-  return new DOMException("the call's deadline passed; claudish stopped its work", "AbortError");
-}
-function raceCallAbort(p, signal) {
-  if (!signal)
-    return p;
-  p.catch(() => {});
-  if (signal.aborted)
-    return Promise.reject(callAbortError());
-  return new Promise((resolve, reject) => {
-    const onAbort = () => reject(callAbortError());
-    signal.addEventListener("abort", onAbort, { once: true });
-    p.then((value) => {
-      signal.removeEventListener("abort", onAbort);
-      resolve(value);
-    }, (err) => {
-      signal.removeEventListener("abort", onAbort);
-      reject(err);
-    });
-  });
-}
-function sleepUnlessAborted(ms, signal) {
-  if (signal?.aborted)
-    return Promise.resolve(true);
-  return new Promise((resolve) => {
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve(true);
-    };
-    const timer = setTimeout(() => {
-      signal?.removeEventListener("abort", onAbort);
-      resolve(false);
-    }, ms);
-    signal?.addEventListener("abort", onAbort, { once: true });
-  });
-}
-function withCallSignal(sig, callSignal) {
-  if (!callSignal)
-    return sig;
-  if (!sig)
-    return callSignal;
-  return AbortSignal.any([sig, callSignal]);
-}
-function abortedResponse() {
-  return new Response(JSON.stringify({
-    type: "error",
-    error: {
-      type: "timeout_error",
-      message: "claudish stopped this call: its deadline passed"
-    }
-  }), {
-    status: 408,
-    headers: { "content-type": "application/json", [CALL_ABORTED_HEADER]: "1" }
-  });
-}
-function hopLogOf(c) {
-  return readCallVar(c, HOP_LOG_KEY);
-}
-function recordHopEntry(c, provider, wireModel) {
-  const hops = hopLogOf(c);
-  if (!hops)
-    return;
-  const plannedUid = readCallVar(c, PLANNED_HOP_KEY);
-  const entry = {
-    provider,
-    wireModel,
-    arm: null,
-    billing: null,
-    ...plannedUid ? { plannedUid } : {}
-  };
-  hops.push(entry);
-  return entry;
-}
-async function withPlannedHop(c, plannedUid, work) {
-  if (!hopLogOf(c))
-    return work();
-  const previous = readCallVar(c, PLANNED_HOP_KEY);
-  writeCallVar(c, PLANNED_HOP_KEY, plannedUid);
-  try {
-    return await work();
-  } finally {
-    writeCallVar(c, PLANNED_HOP_KEY, previous);
-  }
-}
-var SIGNING_SECRETS_KEY = "claudishSigningSecrets", detachedCallVars, CREDENTIAL_HEADER_NAMES, CREDENTIAL_HEADER_FRAGMENTS, CREDENTIAL_QUERY_NAMES, AUTH_SCHEME_PREFIX, CALL_ABORT_SIGNAL_KEY = "claudishCallAbortSignal", CALL_ABORTED_HEADER = "x-claudish-call-aborted", HOP_LOG_KEY = "claudishHopLog", PLANNED_HOP_KEY = "claudishPlannedHop";
-var init_call_context = __esm(() => {
-  init_redact();
-  detachedCallVars = new WeakMap;
-  CREDENTIAL_HEADER_NAMES = new Set([
-    "authorization",
-    "proxy-authorization",
-    "x-api-key",
-    "api-key",
-    "x-goog-api-key",
-    "cookie"
-  ]);
-  CREDENTIAL_HEADER_FRAGMENTS = ["token", "secret", "key"];
-  CREDENTIAL_QUERY_NAMES = new Set(["key", "api_key", "token", "access_token"]);
-  AUTH_SCHEME_PREFIX = /^(?:Bearer|Basic|Token)\s+/i;
-});
-
 // src/handlers/shared/gemini-queue.ts
 function rejectIfAborted(request) {
   if (request.onAbort)
@@ -42094,7 +42209,7 @@ class AntigravityCredentialProvider {
     const token = readSharedAntigravityToken();
     if (!token)
       return;
-    const lineage = token.refresh_token ? `refresh:${token.refresh_token}` : token.access_token ? `access:${token.access_token}` : undefined;
+    const lineage = antigravityTokenLineageMaterial(token);
     return lineage ? `${lineage}
 ${antigravityHost()}` : undefined;
   }
@@ -44707,7 +44822,7 @@ var init_dist12 = __esm(() => {
 
 // src/auth/codex-pkce.ts
 import { exec as exec4 } from "child_process";
-import { createHash as createHash12, randomBytes as randomBytes7 } from "crypto";
+import { createHash as createHash13, randomBytes as randomBytes7 } from "crypto";
 import { createServer } from "http";
 import { promisify as promisify3 } from "util";
 function loginClaims(idToken) {
@@ -44819,7 +44934,7 @@ function waitForCallback(options, deps) {
 async function loginCodexPkce(deps = {}) {
   log("[CodexOAuth] Starting OAuth login flow");
   const verifier = randomBytes7(64).toString("base64url");
-  const challenge = createHash12("sha256").update(verifier).digest("base64url");
+  const challenge = createHash13("sha256").update(verifier).digest("base64url");
   const state = randomBytes7(32).toString("base64url");
   const options = {
     port: 1455,
@@ -48499,10 +48614,6 @@ var init_dynamic_models_catalog_store = __esm(() => {
 
 // src/providers/dynamic-models-catalog.ts
 import { createHmac as createHmac2, randomBytes as randomBytes11 } from "crypto";
-function isPersistedListProvider(provider) {
-  const def = getProviderByName(provider);
-  return def !== undefined && def.modelDiscovery !== undefined && !def.isLocal && (def.tier === "subscription" || def.tier === "dynamic-subscription");
-}
 function nowOf2(opts) {
   return opts?.now ? opts.now() : Date.now();
 }
@@ -48706,6 +48817,7 @@ var init_dynamic_models_catalog = __esm(() => {
   inFlight4 = new Map;
   listeners = new Set;
   credentials.onInvalidate((name) => {
+    invalidateModelDiscovery(name);
     if (name) {
       identityMemo.delete(name);
       liveMemory.delete(name);
@@ -50149,6 +50261,7 @@ var init_devin_request = __esm(() => {
 });
 
 // src/providers/devin/devin-models.ts
+import { createHash as createHash14 } from "crypto";
 function unaryMetadata(apiKey) {
   return msg(bytes(1, "chisel"), bytes(2, DEVIN_CLI_VERSION), bytes(3, apiKey), bytes(4, "en"), bytes(5, process.platform), bytes(7, DEVIN_CLI_VERSION));
 }
@@ -50336,20 +50449,25 @@ function decodeAllowedUids(body) {
   }
   return uids;
 }
+function hashApiKey(apiKey) {
+  return createHash14("sha256").update(apiKey).digest("hex");
+}
 async function getServedDevinModels(opts) {
   const now = Date.now();
-  if (!opts?.force && modelsCatalogCache && now - modelsCatalogCacheAt < MODELS_CATALOG_TTL_MS)
-    return modelsCatalogCache;
   const apiKey = opts?.apiKey ?? readDevinApiKey();
   if (!apiKey)
-    return modelsCatalogCache ?? [];
+    return [];
+  const keyHash = hashApiKey(apiKey);
+  const sameKeyCache = modelsCatalogCacheKeyHash === keyHash ? modelsCatalogCache : null;
+  if (!opts?.force && sameKeyCache && now - modelsCatalogCacheAt < MODELS_CATALOG_TTL_MS)
+    return sameKeyCache;
   try {
     const [configs, allowed] = await Promise.all([
       fetchDevinModelConfigs(apiKey),
       fetchDevinAllowedUids(apiKey)
     ]);
     if (configs.length === 0)
-      return modelsCatalogCache ?? [];
+      return sameKeyCache ?? [];
     const entitled = new Set(allowed);
     const served = configs.filter((config) => config.contextWindow > 0 && (entitled.size === 0 || entitled.has(config.uid)));
     if (entitled.size === 0) {
@@ -50357,13 +50475,14 @@ async function getServedDevinModels(opts) {
     }
     modelsCatalogCache = served;
     modelsCatalogCacheAt = now;
+    modelsCatalogCacheKeyHash = keyHash;
     return served;
   } catch (err) {
     log(`[Devin] served-model discovery error: ${err}`);
-    return modelsCatalogCache ?? [];
+    return sameKeyCache ?? [];
   }
 }
-var MODEL_CONFIGS_PATH = "/exa.api_server_pb.ApiServerService/GetCliModelConfigs", TEAM_SETTINGS_PATH = "/exa.seat_management_pb.SeatManagementService/GetCliTeamSettings", MODELS_CATALOG_TTL_MS, UNARY_TIMEOUT_MS = 1e4, modelsCatalogCache = null, modelsCatalogCacheAt = 0;
+var MODEL_CONFIGS_PATH = "/exa.api_server_pb.ApiServerService/GetCliModelConfigs", TEAM_SETTINGS_PATH = "/exa.seat_management_pb.SeatManagementService/GetCliTeamSettings", MODELS_CATALOG_TTL_MS, UNARY_TIMEOUT_MS = 1e4, modelsCatalogCache = null, modelsCatalogCacheAt = 0, modelsCatalogCacheKeyHash = null;
 var init_devin_models = __esm(() => {
   init_logger();
   init_devin_credentials();
@@ -50829,6 +50948,7 @@ var init_model_discovery_builtins = __esm(() => {
 });
 
 // src/providers/model-discovery.ts
+import { createHash as createHash15 } from "crypto";
 function toModelsCatalogEntry(model) {
   const { id, ...rest } = model;
   return { wireId: id, ...rest };
@@ -50839,6 +50959,10 @@ function registerModelDiscoveryFetcher(format, fetcher) {
 function getModelDiscoveryFetcher(format) {
   return _fetchers.get(format);
 }
+async function accountFingerprint(providerName) {
+  const identity = await credentials.accountIdentity(providerName, { allowOpPrompt: false });
+  return identity ? createHash15("sha256").update(identity).digest("hex") : undefined;
+}
 function recordFailure(failure) {
   _failures.set(failure.provider, failure);
   log(`[model-discovery:${failure.provider}] ${describeDiscoveryFailure(failure)}`);
@@ -50876,15 +51000,20 @@ function describeDiscoveryFailure(failure) {
       return `the endpoint answered${at} but listed no models`;
   }
 }
+function invalidationCount(providerName) {
+  return invalidationsOfAll + (invalidationsByProvider.get(providerName) ?? 0);
+}
 function invalidateModelDiscovery(provider) {
   if (provider) {
     _cache2.delete(provider);
     _failures.delete(provider);
     coldRefreshes.delete(provider);
+    invalidationsByProvider.set(provider, (invalidationsByProvider.get(provider) ?? 0) + 1);
   } else {
     _cache2.clear();
     _failures.clear();
     coldRefreshes.clear();
+    invalidationsOfAll++;
   }
 }
 function registryModelsEndpoint(providerName, def) {
@@ -51007,7 +51136,6 @@ async function discoverViaFetcher(providerName, format) {
   }
   _failures.delete(providerName);
   log(`[model-discovery:${providerName}] discovered ${models.length} models`);
-  _cache2.set(providerName, { models, expiresAt: Date.now() + CACHE_TTL_MS2 });
   return { kind: "served", models };
 }
 async function discoverProviderModelsCatalog(providerName) {
@@ -51041,9 +51169,32 @@ function peekDiscoveredModels(providerName) {
   return cached && cached.expiresAt > Date.now() ? cached.models : undefined;
 }
 async function discoverEveryServedModel(providerName) {
+  if (!getProviderByName(providerName)?.modelDiscovery) {
+    return { kind: "unsupported", reason: "no-descriptor" };
+  }
+  const invalidationsBefore = invalidationCount(providerName);
+  const perAccount = isPersistedListProvider(providerName);
+  const accountBefore = perAccount ? await accountFingerprint(providerName) : undefined;
   const cached = _cache2.get(providerName);
-  if (cached && cached.expiresAt > Date.now())
+  if (cached && cached.expiresAt > Date.now() && cached.account === accountBefore) {
     return { kind: "served", models: cached.models };
+  }
+  const outcome = await fetchServedModels(providerName);
+  if (outcome.kind !== "served")
+    return outcome;
+  const accountAfter = perAccount ? await accountFingerprint(providerName) : undefined;
+  if (accountBefore && accountAfter && accountBefore !== accountAfter)
+    return outcome;
+  if (invalidationCount(providerName) !== invalidationsBefore)
+    return outcome;
+  _cache2.set(providerName, {
+    models: outcome.models,
+    expiresAt: Date.now() + CACHE_TTL_MS2,
+    account: accountAfter ?? accountBefore
+  });
+  return outcome;
+}
+async function fetchServedModels(providerName) {
   const def = getProviderByName(providerName);
   const descriptor = def?.modelDiscovery;
   if (!def || !descriptor)
@@ -51137,7 +51288,6 @@ async function discoverEveryServedModel(providerName) {
   const models = parsed.models;
   _failures.delete(providerName);
   log(`[model-discovery:${providerName}] discovered ${models.length} models from ${endpoint}: ` + models.map((m) => `${m.id}(${m.contextWindow ?? "?"})`).join(", "));
-  _cache2.set(providerName, { models, expiresAt: Date.now() + CACHE_TTL_MS2 });
   return { kind: "served", models };
 }
 async function discoverProviderModels(providerName) {
@@ -51200,7 +51350,7 @@ function rankDiscoveredModels(models) {
     return diff !== 0 ? diff : compareByReleaseDateDesc(a, b);
   });
 }
-var _fetchers, CACHE_TTL_MS2, FETCH_TIMEOUT_MS3 = 5000, _cache2, _failures, coldRefreshes, MIN_CREATED_SECONDS = 946684800, MAX_CREATED_SECONDS = 4102444800, CONTINUATION_FIELDS, LIVE_DISCOVERY_BOUND_MS = 2000;
+var _fetchers, CACHE_TTL_MS2, FETCH_TIMEOUT_MS3 = 5000, _cache2, _failures, coldRefreshes, invalidationsByProvider, invalidationsOfAll = 0, MIN_CREATED_SECONDS = 946684800, MAX_CREATED_SECONDS = 4102444800, CONTINUATION_FIELDS, LIVE_DISCOVERY_BOUND_MS = 2000;
 var init_model_discovery = __esm(() => {
   init_authority();
   init_logger();
@@ -51211,6 +51361,7 @@ var init_model_discovery = __esm(() => {
   _cache2 = new Map;
   _failures = new Map;
   coldRefreshes = new Map;
+  invalidationsByProvider = new Map;
   CONTINUATION_FIELDS = ["has_more", "next", "next_page", "next_page_token"];
 });
 
@@ -59756,12 +59907,12 @@ var init_ollamacloud = __esm(() => {
 });
 
 // src/providers/transport/conversation-key.ts
-import { createHash as createHash13, randomBytes as randomBytes13 } from "crypto";
+import { createHash as createHash16, randomBytes as randomBytes13 } from "crypto";
 function conversationKey(claudeRequest) {
   const sessionId = extractSessionId(claudeRequest);
   if (!sessionId)
     return `claudish_${FALLBACK_CONVERSATION_KEY}`;
-  return `claudish_${createHash13("sha256").update(sessionId).digest("hex").slice(0, 32)}`;
+  return `claudish_${createHash16("sha256").update(sessionId).digest("hex").slice(0, 32)}`;
 }
 var FALLBACK_CONVERSATION_KEY;
 var init_conversation_key = __esm(() => {
@@ -61281,6 +61432,10 @@ function getProviderByName(name) {
     return builtin;
   return getRuntimeProviders().get(name);
 }
+function isPersistedListProvider(provider) {
+  const def = getProviderByName(provider);
+  return def !== undefined && def.modelDiscovery !== undefined && !def.isLocal && (def.tier === "subscription" || def.tier === "dynamic-subscription");
+}
 function getApiKeyInfo(providerName) {
   const def = getProviderByName(providerName);
   if (!def)
@@ -74619,14 +74774,14 @@ var init_prehydrate = __esm(() => {
 });
 
 // src/auth/claude-code-facts.ts
-import { createHash as createHash14 } from "crypto";
+import { createHash as createHash17 } from "crypto";
 import { homedir as homedir33 } from "os";
 import { isAbsolute as isAbsolute2, resolve as resolve4 } from "path";
 function defaultConfigDir(env) {
   return resolve4(env.HOME || homedir33(), ".claude");
 }
 function configDirHash(configDir) {
-  return createHash14("sha256").update(configDir).digest("hex").slice(0, 8);
+  return createHash17("sha256").update(configDir).digest("hex").slice(0, 8);
 }
 function claudeCodeKeychainService(env = process.env) {
   const raw = env.CLAUDE_CONFIG_DIR?.trim();
@@ -92866,6 +93021,111 @@ var init_handler_set = __esm(() => {
   init_composed_handler();
 });
 
+// src/handlers/shared/anthropic-forward.ts
+function inboundAuthHeaders(incoming) {
+  const out = {};
+  const authorization = incoming.get("authorization");
+  const apiKey = incoming.get("x-api-key");
+  if (authorization)
+    out.authorization = authorization;
+  if (apiKey)
+    out["x-api-key"] = apiKey;
+  return out;
+}
+function connectionNamed(headers) {
+  const named = new Set;
+  for (const token of (headers.get("connection") ?? "").split(",")) {
+    const name = token.trim().toLowerCase();
+    if (name)
+      named.add(name);
+  }
+  return named;
+}
+function requestHeadersToForward(incoming) {
+  const named = connectionNamed(incoming);
+  const out = {};
+  incoming.forEach((value, name) => {
+    const key = name.toLowerCase();
+    if (!ALLOWED_NAMES.has(key))
+      return;
+    if (HOP_BY_HOP.has(key) || named.has(key) || key.startsWith(INTERNAL_PREFIX))
+      return;
+    out[key] = value;
+  });
+  return out;
+}
+function querySegmentName(segment) {
+  const eq = segment.indexOf("=");
+  const rawName = eq < 0 ? segment : segment.slice(0, eq);
+  try {
+    return decodeURIComponent(rawName.replace(/\+/g, " "));
+  } catch {
+    return null;
+  }
+}
+function forwardedSearch(c) {
+  const url = c.req.url;
+  if (typeof url !== "string" || url.length === 0)
+    return "";
+  let search;
+  try {
+    search = new URL(url).search;
+  } catch {
+    return "";
+  }
+  const kept = search.slice(1).split("&").filter((segment) => {
+    const name = querySegmentName(segment);
+    return name !== null && ALLOWED_QUERY_NAMES.has(name);
+  });
+  return kept.length > 0 ? `?${kept.join("&")}` : "";
+}
+function recordInboundBody(c, raw, parsed) {
+  c.set(INBOUND_BODY_KEY, { raw, canonical: JSON.stringify(parsed) });
+}
+function bodyToForward(c, payload) {
+  const serialized = JSON.stringify(payload);
+  const inbound = c.get(INBOUND_BODY_KEY);
+  return inbound !== undefined && inbound.canonical === serialized ? inbound.raw : serialized;
+}
+var ALLOWED_NAMES, HOP_BY_HOP, INTERNAL_PREFIX = "x-claudish-", ALLOWED_QUERY_NAMES, INBOUND_BODY_KEY = "inboundBody";
+var init_anthropic_forward = __esm(() => {
+  ALLOWED_NAMES = new Set([
+    "authorization",
+    "x-api-key",
+    "content-type",
+    "accept",
+    "accept-encoding",
+    "user-agent",
+    "x-app",
+    "anthropic-beta",
+    "anthropic-version",
+    "anthropic-dangerous-direct-browser-access",
+    "x-claude-code-session-id",
+    "x-stainless-arch",
+    "x-stainless-lang",
+    "x-stainless-os",
+    "x-stainless-package-version",
+    "x-stainless-retry-count",
+    "x-stainless-runtime",
+    "x-stainless-runtime-version",
+    "x-stainless-timeout"
+  ]);
+  HOP_BY_HOP = new Set([
+    "connection",
+    "keep-alive",
+    "proxy-connection",
+    "proxy-authenticate",
+    "proxy-authorization",
+    "te",
+    "trailer",
+    "transfer-encoding",
+    "upgrade",
+    "host",
+    "content-length"
+  ]);
+  ALLOWED_QUERY_NAMES = new Set(["beta"]);
+});
+
 // src/handlers/shared/thinking-signature.ts
 function isUnsignedThinking(block) {
   if (!block || typeof block !== "object")
@@ -92956,7 +93216,10 @@ class NativeHandler {
   }
   async handle(c, incoming) {
     const payload = await this.applyRequestHooks(c, incoming);
-    const originalHeaders = c.req.header();
+    const headers = {
+      ...requestHeadersToForward(c.req.raw.headers),
+      ...inboundAuthHeaders(c.req.raw.headers)
+    };
     const target = payload.model;
     const strippedThinking = stripUnsignedThinkingBlocks(payload.messages);
     if (strippedThinking > 0) {
@@ -92965,22 +93228,15 @@ class NativeHandler {
     const advisorSwapped = c.get(ADVISOR_SWAPPED_CONTEXT_KEY) === true;
     log(`
 === [NATIVE] Claude Code \u2192 Anthropic API Request ===`);
-    log(`[Native] x-api-key: ${originalHeaders["x-api-key"] ? maskCredential(originalHeaders["x-api-key"]) : "(not set)"}`);
-    log(`[Native] authorization: ${originalHeaders.authorization ? maskCredential(originalHeaders.authorization) : "(not set)"}`);
+    log(`[Native] x-api-key: ${headers["x-api-key"] ? maskCredential(headers["x-api-key"]) : "(not set)"}`);
+    log(`[Native] authorization: ${headers.authorization ? maskCredential(headers.authorization) : "(not set)"}`);
     log(`Request body (Model: ${target}):`);
     log(`=== End Request ===
 `);
-    const headers = {
-      "Content-Type": "application/json",
-      "anthropic-version": originalHeaders["anthropic-version"] || "2023-06-01"
-    };
-    if (originalHeaders.authorization) {
-      headers.authorization = originalHeaders.authorization;
-    }
-    if (originalHeaders["x-api-key"]) {
-      headers["x-api-key"] = originalHeaders["x-api-key"];
-    }
-    if (!originalHeaders.authorization && !originalHeaders["x-api-key"]) {
+    headers["content-type"] = "application/json";
+    if (!headers["anthropic-version"])
+      headers["anthropic-version"] = "2023-06-01";
+    if (!headers.authorization && !headers["x-api-key"]) {
       let fallbackKey = this.apiKey;
       if (!fallbackKey) {
         const auth = await credentials.getRequestAuth("native-anthropic", { model: target });
@@ -92990,28 +93246,27 @@ class NativeHandler {
         headers["x-api-key"] = fallbackKey;
       }
     }
-    if (originalHeaders["anthropic-beta"]) {
-      const incomingBeta = originalHeaders["anthropic-beta"];
-      if (advisorSwapped) {
-        const { stripped, changed } = stripAdvisorBeta(incomingBeta);
-        if (changed) {
-          log(`[Native][advisor-swap] stripped advisor-tool beta; before=${incomingBeta} after=${stripped ?? "(empty)"}`);
-          logAdvisorEvent(loadAdvisorSwapConfig(this.advisorModels, this.advisorCollector), {
-            kind: "beta_stripped",
-            before: incomingBeta,
-            after: stripped ?? ""
-          });
-        }
-        if (stripped)
-          headers["anthropic-beta"] = stripped;
-      } else {
-        headers["anthropic-beta"] = incomingBeta;
+    const incomingBeta = headers["anthropic-beta"];
+    if (incomingBeta && advisorSwapped) {
+      const { stripped, changed } = stripAdvisorBeta(incomingBeta);
+      if (changed) {
+        log(`[Native][advisor-swap] stripped advisor-tool beta; before=${incomingBeta} after=${stripped ?? "(empty)"}`);
+        logAdvisorEvent(loadAdvisorSwapConfig(this.advisorModels, this.advisorCollector), {
+          kind: "beta_stripped",
+          before: incomingBeta,
+          after: stripped ?? ""
+        });
       }
+      if (stripped)
+        headers["anthropic-beta"] = stripped;
+      else
+        delete headers["anthropic-beta"];
     }
-    addSigningSecrets(c, credentialValuesFromRequest(headers));
-    const body = JSON.stringify(payload);
+    const url = `${this.baseUrl}/v1/messages${forwardedSearch(c)}`;
+    addSigningSecrets(c, credentialValuesFromRequest(headers, url));
+    const body = bodyToForward(c, payload);
     try {
-      const anthropicResponse = await fetch(`${this.baseUrl}/v1/messages`, {
+      const anthropicResponse = await fetch(url, {
         method: "POST",
         headers,
         body
@@ -93163,6 +93418,7 @@ var init_native_handler = __esm(() => {
   init_advisor_decorator();
   init_native_handler_advisor();
   init_anthropic_error();
+  init_anthropic_forward();
   init_call_context();
 });
 
@@ -94281,7 +94537,9 @@ ${plan.hint}` : `[Route] ${plan.reason}`;
   app.post("/v1/messages", async (c) => {
     let handlerThrew = false;
     try {
-      const body = await c.req.json();
+      const raw = await c.req.text();
+      const body = JSON.parse(raw);
+      recordInboundBody(c, raw, body);
       log(`[RequestMeta] model=${body.model} output_config=${JSON.stringify(body.output_config) ?? "(none)"} metadata=${JSON.stringify(body.metadata) ?? "(none)"} anthropic-beta=${c.req.header("anthropic-beta") ?? "(none)"}`);
       maybeCaptureClassifierRequest(c, body);
       if (!monitorMode && options.classifier?.enabled && isAutoModeClassifierRequest(body)) {
@@ -94359,6 +94617,7 @@ var init_proxy_server = __esm(() => {
   init_native_handler_advisor();
   init_native_handler();
   init_anthropic_error();
+  init_anthropic_forward();
   init_call_context();
   init_hop_decision();
   init_hooks();
@@ -97189,6 +97448,30 @@ var init_pane_launch = __esm(() => {
   FATAL_MAGMUX_STDERR = /ignoring --id|magmux: (?:--sock-dir|MAGMUX_SOCK_DIR) |magmux: socket/;
 });
 
+// src/process-tree.ts
+function waitForExit(proc, ms) {
+  if (proc.exitCode !== null || proc.signalCode !== null)
+    return Promise.resolve(true);
+  return new Promise((resolve) => {
+    let settled = false;
+    const done = (value) => {
+      if (settled)
+        return;
+      settled = true;
+      proc.off("exit", onExit);
+      resolve(value);
+    };
+    const onExit = () => done(true);
+    proc.once("exit", onExit);
+    const t = setTimeout(() => done(false), ms);
+    t.unref?.();
+  });
+}
+var KILL_PROCESS_GROUP;
+var init_process_tree = __esm(() => {
+  KILL_PROCESS_GROUP = process.platform !== "win32";
+});
+
 // src/recovery/types.ts
 var UI_LEASE_MS = 1e4, FRAME_TICK_MS = 1000;
 
@@ -98655,7 +98938,7 @@ Or set CLAUDE_PATH to your custom installation:`);
       } catch {}
     });
   }
-  setupSignalHandlers(proc, tempSettingsPath, config.quiet, onCleanup);
+  const signalShutdown = setupSignalHandlers(proc, tempSettingsPath, config.quiet, onCleanup);
   const { exitCode, exitSignal } = await new Promise((resolve) => {
     proc.on("exit", (code, signal) => {
       setClaudeCodeRunning(false);
@@ -98682,22 +98965,45 @@ Or set CLAUDE_PATH to your custom installation:`);
   try {
     unlinkSync11(tempSettingsPath);
   } catch {}
+  signalShutdown.launcherCleanupDone();
+  if (signalShutdown.started())
+    return new Promise(() => {});
   return exitCode;
 }
 function sessionOutcomeOf(exitCode) {
   return exitCode === 0 ? { state: "COMPLETED", reason: null, exitCode } : { state: "FAILED", reason: "child_exited", exitCode };
 }
+function delay(ms) {
+  return new Promise((resolve) => {
+    const t = setTimeout(resolve, Math.max(0, ms));
+    t.unref?.();
+  });
+}
 function setupSignalHandlers(proc, tempSettingsPath, quiet, onCleanup) {
   const signals = isWindows2() ? ["SIGINT", "SIGTERM"] : ["SIGINT", "SIGTERM", "SIGHUP"];
-  claimSignalExit();
-  for (const signal of signals) {
-    process.on(signal, () => {
-      releaseTerminalIsolation();
-      if (!quiet) {
-        console.error(`
-[claudish] Received ${signal}, shutting down...`);
+  let shuttingDown = null;
+  let markLauncherCleanupDone = () => {};
+  const launcherCleanup = new Promise((resolve) => {
+    markLauncherCleanupDone = resolve;
+  });
+  const shutdown = async (signal) => {
+    const startedAt = Date.now();
+    try {
+      proc.kill("SIGTERM");
+      if (!await waitForExit(proc, SIGNAL_CHILD_EXIT_GRACE_MS)) {
+        log(`[claudish] Claude Code did not exit within ${SIGNAL_CHILD_EXIT_GRACE_MS} ms of SIGTERM; sending SIGKILL`);
+        try {
+          proc.kill("SIGKILL");
+        } catch {}
+        await waitForExit(proc, SIGNAL_CHILD_KILL_WAIT_MS);
       }
-      proc.kill();
+      await Promise.race([
+        launcherCleanup,
+        delay(SIGNAL_SHUTDOWN_BUDGET_MS - (Date.now() - startedAt))
+      ]);
+    } catch (err) {
+      log(`[claudish] Signal shutdown error: ${err}`);
+    } finally {
       if (onCleanup) {
         try {
           onCleanup();
@@ -98707,8 +99013,28 @@ function setupSignalHandlers(proc, tempSettingsPath, quiet, onCleanup) {
         unlinkSync11(tempSettingsPath);
       } catch {}
       process.exit(signalExitCode(signal));
+    }
+  };
+  claimSignalExit();
+  for (const signal of signals) {
+    process.on(signal, () => {
+      if (shuttingDown) {
+        log(`[claudish] Received ${signal} while shutting down from ${shuttingDown}; ignored`);
+        return;
+      }
+      shuttingDown = signal;
+      releaseTerminalIsolation();
+      if (!quiet) {
+        console.error(`
+[claudish] Received ${signal}, shutting down...`);
+      }
+      shutdown(signal);
     });
   }
+  return {
+    started: () => shuttingDown !== null,
+    launcherCleanupDone: () => markLauncherCleanupDone()
+  };
 }
 async function findClaudeBinary(env = process.env) {
   const isWindows = process.platform === "win32";
@@ -98809,7 +99135,7 @@ var restoreTerminal = null, macosKeychainAnthropicMemo, defaultKeychainAnthropic
   }
   macosKeychainAnthropicMemo.set(memoKey, found);
   return found;
-}, CLAUDISH_PLACEHOLDER_API_KEY = "sk-ant-api03-placeholder-not-used-proxy-handles-auth-with-openrouter-key-xxxxxxxxxxxxxxxxxxxxx", CLAUDISH_PLACEHOLDER_AUTH_TOKEN = "placeholder-token-not-used-proxy-handles-auth", STALE_TOKEN_FILE_MS, MAX_TOKEN_FILES_SCANNED = 4000, CLAUDE_CODE_DEFAULT_MAX_CONTEXT = 200000, USER_STATUS_LINE_TIMEOUT_SECONDS = 3, MIN_AUTO_COMPACT_WINDOW = 200000, MAX_AUTO_COMPACT_WINDOW = 1e6, ADVISOR_TOOL_ENV_VAR = "CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL", CLAUDISH_CHILD_ADVISOR_MODEL = "sonnet", CHILD_STDERR_NOISE;
+}, CLAUDISH_PLACEHOLDER_API_KEY = "sk-ant-api03-placeholder-not-used-proxy-handles-auth-with-openrouter-key-xxxxxxxxxxxxxxxxxxxxx", CLAUDISH_PLACEHOLDER_AUTH_TOKEN = "placeholder-token-not-used-proxy-handles-auth", STALE_TOKEN_FILE_MS, MAX_TOKEN_FILES_SCANNED = 4000, CLAUDE_CODE_DEFAULT_MAX_CONTEXT = 200000, USER_STATUS_LINE_TIMEOUT_SECONDS = 3, MIN_AUTO_COMPACT_WINDOW = 200000, MAX_AUTO_COMPACT_WINDOW = 1e6, ADVISOR_TOOL_ENV_VAR = "CLAUDE_CODE_ENABLE_EXPERIMENTAL_ADVISOR_TOOL", CLAUDISH_CHILD_ADVISOR_MODEL = "sonnet", CHILD_STDERR_NOISE, SIGNAL_CHILD_EXIT_GRACE_MS = 3000, SIGNAL_CHILD_KILL_WAIT_MS = 500, SIGNAL_SHUTDOWN_BUDGET_MS = 4000;
 var init_claude_runner = __esm(() => {
   init_model_catalog();
   init_claude_code_facts();
@@ -98825,6 +99151,7 @@ var init_claude_runner = __esm(() => {
   init_logger();
   init_child_env();
   init_pane_launch();
+  init_process_tree();
   init_profile_config();
   init_model_discovery();
   init_model_parser();
@@ -99858,30 +100185,6 @@ var init_gate_binding = __esm(() => {
   init_input_gate();
 });
 
-// src/process-tree.ts
-function waitForExit(proc, ms) {
-  if (proc.exitCode !== null || proc.signalCode !== null)
-    return Promise.resolve(true);
-  return new Promise((resolve) => {
-    let settled = false;
-    const done = (value) => {
-      if (settled)
-        return;
-      settled = true;
-      proc.off("exit", onExit);
-      resolve(value);
-    };
-    const onExit = () => done(true);
-    proc.once("exit", onExit);
-    const t = setTimeout(() => done(false), ms);
-    t.unref?.();
-  });
-}
-var KILL_PROCESS_GROUP;
-var init_process_tree = __esm(() => {
-  KILL_PROCESS_GROUP = process.platform !== "win32";
-});
-
 // src/pane/pane-reap.ts
 function alive(p) {
   return !!p && p.exitCode === null && p.signalCode === null;
@@ -121887,14 +122190,14 @@ function reportFetchFailure(state, cache, now) {
   if (state === "stale") {
     const ageMs = now.getTime() - Date.parse(cache.lastUpdated);
     const ageStr = humanizeAge(ageMs);
-    process.stderr.write(`WARNING: Catalog stale (${ageStr}). Using cached version. Run \`claudish --models-refresh\` to retry.
+    process.stderr.write(`WARNING: The ${MODEL_CATALOG_NAME} is stale (${ageStr}). Using cached version. Run \`claudish --models-refresh\` to retry.
 `);
     return "warned";
   }
   if (state === "fresh") {
     const ageMs = now.getTime() - Date.parse(cache.lastUpdated);
     const ageStr = humanizeAge(ageMs);
-    process.stderr.write(`WARNING: Catalog refresh failed (cache age ${ageStr}). Using cached version.
+    process.stderr.write(`WARNING: Could not refresh the ${MODEL_CATALOG_NAME} (cache age ${ageStr}). Using cached version.
 `);
     return "warned";
   }